Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,408 detections
Filters
Last updated
All Time
Detection languages
3,122
2,730
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,696
1,319
905
813
750
Platforms
5,933
913
886
299
280
Products / Services
1,617
1,401
1,091
454
419
MITRE Techniques
18,128
15,650
12,597
8,408
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report
Detects activity mentioned in Operation Wocao report
Detects potential Dridex acitvity via specific process patterns
Detects the execution of an executable that is typically used by PlugX for DLL side loading starting from an uncommon location
Detects the setting of a custom protocol handler with the name "rogue".
Seen being created by Forest Blizzard APT as reported by MSFT.
Seen being created by Forest Blizzard APT as reported by MSFT.
Detects post exploitation execution technique of the Serpent backdoor.
According to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method.
It creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.
According to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method.
It creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.
A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques.
This query was originally published in the threat analytics report, Msiexec abuse.
Msiexec.exe is a Windows component that installs files with the .msi extension. These kinds of files are Windows installer packages, and are used by a wide array of legitimate software. However, malicious actors can re-purpose msiexec.exe for living-off-the-land attacks, where they use legitimate system binaries on the compromised device to perform attacks.
The following query detects activity associated with misuse of msiexec.exe, particularly alongside mimikatz, a common credential dumper and privilege escalation tool.
Reference - https://www.varonis.com/blog/what-is-mimikatz/
Msiexec.exe is a Windows component that installs files with the .msi extension. These kinds of files are Windows installer packages, and are used by a wide array of legitimate software. However, malicious actors can re-purpose msiexec.exe for living-off-the-land attacks, where they use legitimate system binaries on the compromised device to perform attacks.
The following query detects activity associated with misuse of msiexec.exe, particularly alongside mimikatz, a common credential dumper and privilege escalation tool.
Reference - https://www.varonis.com/blog/what-is-mimikatz/
Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a UAC bypass attempt
Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.
Detects the use of the Dinject PowerShell cradle based on the specific flags
Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes
Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service
Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hide services or make them unstoppable.
Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)
Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type
Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.
Detects creation of a new service (kernel driver) with the type "kernel"
Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware
Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which makes the service hidden and unremovable.
Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations
Page 326 of 401